@rightkit/release 0.2.85 → 0.2.87

package/build-release.mjs

@@ -28,6 +28,7 @@ import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBui
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
+import { resolveReleaseCacheMode } from "./release-cache-mode.mjs";
 import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
@@ -203,8 +204,7 @@ try {
   const managedCargoTarget = brokerManagedHost(process.env) ? resolveTargetRoot(cargoToml) : null;
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
-  const cacheModeRequested = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
-  if (cacheModeRequested !== "legacy" && cacheModeRequested !== "shared") fail("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
+  const cacheModeRequested = resolveReleaseCacheMode({ requested: process.env.RIGHT_RELEASE_CACHE_MODE, platform, env: process.env });
   // On a broker-managed host, Cache V2's lease/slot/prune/floor/mark chain is not
   // running against the directory that will actually hold build output — the
   // broker owns CARGO_TARGET_DIR unconditionally (see managedCargoTarget above).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.85",
+  "version": "0.2.87",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release-cache-mode.mjs

@@ -0,0 +1,8 @@
+export function resolveReleaseCacheMode({ requested, platform, env = process.env } = {}) {
+  const fallback = env.GITHUB_ACTIONS === "true"
+    ? "legacy"
+    : platform === "mac" || platform === "win" ? "shared" : "legacy";
+  const mode = requested ?? fallback;
+  if (mode !== "legacy" && mode !== "shared") throw new Error("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
+  return mode;
+}

package/release-invocation.mjs

@@ -15,7 +15,7 @@ function canonical(file) {
   return path.normalize(realpathSync(file)).toLowerCase();
 }
 
-export function assertPrimaryReleaseCheckout(repoRoot) {
+export function assertPrimaryReleaseCheckout(repoRoot, env = process.env) {
   const worktrees = git(repoRoot, ["worktree", "list", "--porcelain"]);
   const gitDir = git(repoRoot, ["rev-parse", "--git-dir"]).trim();
   const configured = spawnSync("git", ["config", "--path", "--get", "core.worktree"], {
@@ -32,7 +32,35 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
     throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
   }
   const branch = spawnSync("git", ["symbolic-ref", "--quiet", "HEAD"], { cwd: repoRoot, encoding: "utf8", windowsHide: true });
-  if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
+  if (branch.status !== 0 && !isVerifiedGithubActionsTagCheckout(repoRoot, env)) {
+    throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
+  }
+}
+
+function isVerifiedGithubActionsTagCheckout(repoRoot, env) {
+  const ref = env.GITHUB_REF;
+  const sha = env.GITHUB_SHA;
+  if (
+    env.GITHUB_ACTIONS !== "true"
+    || env.GITHUB_EVENT_NAME !== "push"
+    || env.GITHUB_REF_TYPE !== "tag"
+    || !/^refs\/tags\/v.+$/.test(ref ?? "")
+    || !/^[a-f0-9]{40}$/.test(sha ?? "")
+    || !/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(env.GITHUB_REPOSITORY ?? "")
+  ) return false;
+  const head = git(repoRoot, ["rev-parse", "HEAD"]).trim();
+  if (head !== sha) return false;
+  let tagCommit;
+  let origin;
+  try {
+    tagCommit = git(repoRoot, ["rev-parse", `${ref}^{commit}`]).trim();
+    origin = git(repoRoot, ["remote", "get-url", "origin"]).trim();
+  } catch {
+    return false;
+  }
+  if (tagCommit !== head) return false;
+  const repository = origin.match(/(?:github\.com[/:])([^/\s]+\/[^/\s]+?)(?:\.git)?\/?$/i)?.[1];
+  return repository?.toLowerCase() === env.GITHUB_REPOSITORY.toLowerCase();
 }
 
 export function resolvePrimaryWorktree({ repoRoot, worktrees, gitDir, coreWorktree }) {

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.85",
+    "@rightkit/release": "0.2.87",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },